quinn-proto vulnerabilities
CVEs whose affected-version data names the quinn-proto package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
8 CVEsRSS
RUSTSEC-2026-0343High· 7.5Outgoing datagram buffer accounting can panic the sender in quinn-proto
Outgoing datagram buffer accounting can panic the sender in quinn-proto
RUSTSEC-2026-0340High· 7.5Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
RUSTSEC-2026-0338NoneRemote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
RUSTSEC-2026-0342NoneZero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
RUSTSEC-2026-0341High· 7.5Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
RUSTSEC-2026-0339NoneUnbounded growth of pending connection ID retirements in quinn-proto
Unbounded growth of pending connection ID retirements in quinn-proto
GHSA-4w2j-m93h-cj5jHigh· 7.5Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
CVE-2026-25800High· 7.5quinn: Quinn: Remote memory exhaustion via malformed QUIC stream fragments (CVE-2026-25800)
A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in t…